[vim/vim] use-after-free with 'qftf' wiping buffer (PR #19142)
Christian Brabandt
Problem: use-after-free with 'qftf' wiping buffer
Solution: Forbid changing the window layout or wiping the buffers.
You can view, comment on, or merge this pull request online at:
https://github.com/vim/vim/pull/19142
Commit Summary
- 324f25f use-after-free with 'qftf' wiping buffer
File Changes
(3 files)
- M runtime/doc/options.txt (3)
- M src/quickfix.c (6)
- M src/testdir/test_quickfix.vim (23)
Patch Links:
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
zeertzjq
@zeertzjq commented on this pull request.
In src/quickfix.c:
> @@ -5097,6 +5097,9 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx) args[0].vval.v_dict = d; qftf_list = NULL; + window_layout_lock(); + curwin->w_locked = TRUE; + curbuf->b_locked = TRUE;⬇️ Suggested change
- curbuf->b_locked = TRUE; + curbuf->b_locked++;
In src/quickfix.c:
> @@ -5106,6 +5109,9 @@ call_qftf_func(qf_list_T *qfl, int qf_winid, long start_idx, long end_idx) } clear_tv(&rettv); } + curbuf->b_locked = FALSE;⬇️ Suggested change
- curbuf->b_locked = FALSE; + curbuf->b_locked--;
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.
zeertzjq
zeertzjq left a comment (vim/vim#19142)eval_foldexpr() just uses textlock, which is simpler and safer (but it also prevents changing text). I guess textlock can be used here instead too?
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Christian Brabandt
chrisbra left a comment (vim/vim#19142). I guess textlock can be used here instead too, or is it too restrictive?
Yeah, I wondered about this too. In principle that should be fine for the quickfixtextfunc. Let me see if this prevents a :bw
—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.
Christian Brabandt
@chrisbra pushed 1 commit.
- 900add5 Enable textlock when evaluating quickftextfunc
—
View it on GitHub or unsubscribe.
You are receiving this because you are subscribed to this thread.
Christian Brabandt
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.